URL:

https://drive.google.com/file/d/1Jx_fFgNYfTU6ngac6NgOlZD7dAQs7vFC/view?usp=drive_link

Full analysis: https://app.any.run/tasks/6393555e-214f-4107-a0bf-d5127d1da292
Verdict: Malicious activity
Analysis date: February 15, 2024, 11:55:38
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

90F5D3C8A8B197A51F8D8684FB9985B9

SHA1:

889B5FD99D71AA534235C9566D743C4A40F91761

SHA256:

9199B084784462BA3DFBB5ABB47595D58741FA1DF493C0F7A024557EFF17C3EA

SSDEEP:

3:N8PMMtZJuloV3zcnSNrMiM6:2AczcnWrNM6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Documente.pdf.exe (PID: 4000)
      • cmd.exe (PID: 3428)
      • Documente.pdf.exe (PID: 3808)
      • cmd.exe (PID: 3120)

    • Antivirus name has been found in the command line (generic signature)

      • findstr.exe (PID: 3044)
      • findstr.exe (PID: 3412)
      • findstr.exe (PID: 392)
      • findstr.exe (PID: 3048)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Documente.pdf.exe (PID: 4000)
      • Documente.pdf.exe (PID: 3808)

    • Executing commands from a ".bat" file

      • Documente.pdf.exe (PID: 4000)
      • Documente.pdf.exe (PID: 3808)

    • Get information on the list of running processes

      • cmd.exe (PID: 2612)
      • cmd.exe (PID: 1072)

    • Starts CMD.EXE for commands execution

      • Documente.pdf.exe (PID: 4000)
      • cmd.exe (PID: 2612)
      • cmd.exe (PID: 1072)
      • Documente.pdf.exe (PID: 3808)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 2612)
      • cmd.exe (PID: 1072)

    • Executable content was dropped or overwritten

      • Documente.pdf.exe (PID: 4000)
      • cmd.exe (PID: 3428)
      • cmd.exe (PID: 3120)
      • Documente.pdf.exe (PID: 3808)

    • Reads the Internet Settings

      • Documente.pdf.exe (PID: 4000)
      • Documente.pdf.exe (PID: 3808)

    • Drops a file with a rarely used extension (PIF)

      • cmd.exe (PID: 3428)
      • cmd.exe (PID: 3120)

    • Application launched itself

      • cmd.exe (PID: 2612)
      • cmd.exe (PID: 1072)

    • Starts application with an unusual extension

      • cmd.exe (PID: 2612)
      • cmd.exe (PID: 1072)

    • The executable file from the user directory is run by the CMD process

      • Give.pif (PID: 2096)
      • Give.pif (PID: 3548)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 2612)
      • cmd.exe (PID: 1072)

  • INFO

    • Application launched itself

      • firefox.exe (PID: 3240)
      • firefox.exe (PID: 3668)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1784)
      • WinRAR.exe (PID: 3096)

    • Create files in a temporary directory

      • Documente.pdf.exe (PID: 4000)
      • Documente.pdf.exe (PID: 3808)

    • Reads the computer name

      • Documente.pdf.exe (PID: 4000)
      • Give.pif (PID: 2096)
      • Documente.pdf.exe (PID: 3808)
      • Give.pif (PID: 3548)

    • The process uses the downloaded file

      • firefox.exe (PID: 3668)
      • WinRAR.exe (PID: 3436)

    • Checks supported languages

      • Documente.pdf.exe (PID: 4000)
      • Give.pif (PID: 2096)
      • Documente.pdf.exe (PID: 3808)
      • Give.pif (PID: 3548)

    • Manual execution by a user

      • Documente.pdf.exe (PID: 4000)
      • Documente.pdf.exe (PID: 3808)
      • notepad++.exe (PID: 2948)
      • WinRAR.exe (PID: 3096)
      • rundll32.exe (PID: 1172)
      • WinRAR.exe (PID: 3436)
      • WinRAR.exe (PID: 1812)
      • WinRAR.exe (PID: 2940)
      • notepad.exe (PID: 2592)
      • WinRAR.exe (PID: 1784)

    • Reads mouse settings

      • Give.pif (PID: 2096)
      • Give.pif (PID: 3548)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3096)
      • WinRAR.exe (PID: 1784)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
91
Monitored processes
41
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs winrar.exe no specs winrar.exe no specs winrar.exe no specs notepad.exe no specs winrar.exe documente.pdf.exe cmd.exe no specs tasklist.exe no specs findstr.exe no specs findstr.exe no specs tasklist.exe no specs cmd.exe no specs cmd.exe cmd.exe no specs give.pif ping.exe no specs notepad++.exe winrar.exe rundll32.exe no specs documente.pdf.exe cmd.exe no specs findstr.exe no specs tasklist.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe cmd.exe no specs give.pif ping.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
292ping -n 5 localhostC:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
296"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3668.6.170609839\769300557" -childID 5 -isForBrowser -prefsHandle 4180 -prefMapHandle 4184 -prefsLen 29313 -prefMapSize 244195 -jsInitHandle 916 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a84ddfd-eb2a-4e70-bab9-57abc701e126} 3668 "\\.\pipe\gecko-crash-server-pipe.3668" 4168 193cbe00 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
324tasklist C:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
392findstr /I "wrsa.exe opssvc.exe"C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
680ping -n 5 localhostC:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
1072"C:\Windows\System32\cmd.exe" /k move About About.bat & About.bat & exitC:\Windows\System32\cmd.exe—Documente.pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1172"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Downloads\Documente\Documente\Documente\Documente\Documente\Documente\TrainerC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1780"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3668.5.1839122439\1905529914" -childID 4 -isForBrowser -prefsHandle 4036 -prefMapHandle 4040 -prefsLen 29313 -prefMapSize 244195 -jsInitHandle 916 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dae8f337-c1c7-4e77-95df-e4e67f30160d} 3668 "\\.\pipe\gecko-crash-server-pipe.3668" 4060 193cbc90 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
1784"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Downloads\Documente\Documente\Documente\Documente\Documente.rar" C:\Users\admin\Downloads\Documente\Documente\Documente\Documente\Documente\C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1808cmd /c md 31298C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
22 205
Read events
22 059
Write events
139
Delete events
7

Modification events

(PID) Process:(3240) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Launcher
Value:
CDD49C4E01000000
(PID) Process:(3668) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Browser
Value:
B4C79E4E01000000
(PID) Process:(3668) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Installer\308046B0AF4A39CB
Operation:delete valueName:installer.taskbarpin.win10.enabled
Value:
(PID) Process:(3668) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry
Value:
0
(PID) Process:(3668) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\DllPrefetchExperiment
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe
Value:
0
(PID) Process:(3668) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\PreXULSkeletonUISettings
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Theme
Value:
1
(PID) Process:(3668) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\PreXULSkeletonUISettings
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Enabled
Value:
1
(PID) Process:(3668) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|DisableTelemetry
Value:
1
(PID) Process:(3668) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|DisableDefaultBrowserAgent
Value:
0
(PID) Process:(3668) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|SetDefaultBrowserUserChoice
Value:
1
Executable files
6
Suspicious files
94
Text files
51
Unknown types
41

Dropped files

PID
Process
Filename
Type
3668firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.jstext
MD5:60E0DE9E05EC76C749D80F0D15A81B21
SHA256:08252FA62CCCCD316474E20CC7317A6B5C932B2C972234318E8CCDA39EC2EF48
3668firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.jsonbinary
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
3668firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.jstext
MD5:60E0DE9E05EC76C749D80F0D15A81B21
SHA256:08252FA62CCCCD316474E20CC7317A6B5C932B2C972234318E8CCDA39EC2EF48
3668firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
3668firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
3668firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
3668firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
3668firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cert9.db-journalbinary
MD5:CA6C98270B9F3DBA07BC2C661D956B94
SHA256:B26C4C88461C4436885C6246B75F3B5EF39028635ECFF1D36815C77576262C83
3668firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmpbinary
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
3668firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
31
TCP/UDP connections
90
DNS requests
179
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3668
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
text
90 b
unknown
3668
firefox.exe
POST
200
216.58.206.35:80
http://ocsp.pki.goog/gts1c3
unknown
binary
472 b
unknown
3668
firefox.exe
POST
200
195.138.255.24:80
http://r3.o.lencr.org/
unknown
binary
503 b
unknown
3668
firefox.exe
POST
200
195.138.255.24:80
http://r3.o.lencr.org/
unknown
binary
503 b
unknown
3668
firefox.exe
POST
200
195.138.255.24:80
http://r3.o.lencr.org/
unknown
binary
503 b
unknown
3668
firefox.exe
POST
200
216.58.206.35:80
http://ocsp.pki.goog/gts1c3
unknown
binary
471 b
unknown
3668
firefox.exe
POST
200
195.138.255.24:80
http://r3.o.lencr.org/
unknown
binary
503 b
unknown
3668
firefox.exe
POST
200
195.138.255.24:80
http://r3.o.lencr.org/
unknown
binary
503 b
unknown
3668
firefox.exe
POST
200
216.58.206.35:80
http://ocsp.pki.goog/gts1c3
unknown
binary
472 b
unknown
3668
firefox.exe
POST
200
195.138.255.24:80
http://r3.o.lencr.org/
unknown
binary
503 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3668
firefox.exe
142.250.185.174:443
drive.google.com
GOOGLE
US
whitelisted
3668
firefox.exe
34.117.188.166:443
spocs.getpocket.com
—
—
unknown
3668
firefox.exe
142.250.184.202:443
safebrowsing.googleapis.com
—
—
whitelisted
3668
firefox.exe
34.107.221.82:80
detectportal.firefox.com
GOOGLE
US
whitelisted
3668
firefox.exe
34.107.243.93:443
push.services.mozilla.com
GOOGLE
US
unknown
3668
firefox.exe
34.117.237.239:443
contile.services.mozilla.com
GOOGLE-CLOUD-PLATFORM
US
unknown
3668
firefox.exe
216.58.206.35:80
ocsp.pki.goog
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
drive.google.com
  • 151.101.1.140
  • 151.101.65.140
  • 151.101.129.140
  • 151.101.193.140
  • 142.250.185.174
  • 2a00:1450:4001:811::200e
shared
detectportal.firefox.com
  • 34.107.221.82
whitelisted
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
contile.services.mozilla.com
  • 34.117.237.239
whitelisted
example.org
  • 93.184.216.34
whitelisted
ipv4only.arpa
  • 192.0.0.170
  • 192.0.0.171
whitelisted
spocs.getpocket.com
  • 34.117.188.166
shared
gkegw.prod.ads.prod.webservices.mozgcp.net
  • 34.117.188.166
unknown
ocsp.pki.goog
  • 216.58.206.35
whitelisted
pki-goog.l.google.com
  • 216.58.206.35
  • 2a00:1450:4001:829::2003
whitelisted

Threats

No threats detected
Process
Message
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://drive.google.com/file/d/1Jx_fFgNYfTU6ngac6NgOlZD7dAQs7vFC/view?usp=drive_link